tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/DxeCore: Avoid accessing non-owned memory 

The patch fixes two kinds of bugs in DxeCore that accesses memory
which might be freed or owned by other modules.
The two bugs don't cause functionality issue.

1. CoreValidateHandle() checks whether the handle is valid by
   validating its signature. The proper way is to check whether
   the handle is in the handle database.
2. CoreDisconnectControllersUsingProtocolInterface() and
   CoreOpenProtocol() de-reference Link pointer which is
   already freed. The proper way is to not de-reference the pointer.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
This commit is contained in:
Ruiyu Ni 2017-07-05 18:45:56 +08:00
parent 357c48258e
commit 5fc3889bb3
1 changed files with 27 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
MdeModulePkg/Core/Dxe/Hand/Handle.c
View File

@ -72,15 +72,20 @@ CoreValidateHandle (
)
{
IHANDLE *Handle;
LIST_ENTRY *Link;
Handle = (IHANDLE *)UserHandle;
if (Handle == NULL) {
return EFI_INVALID_PARAMETER;
}
if (Handle->Signature != EFI_HANDLE_SIGNATURE) {
if (UserHandle == NULL) {
return EFI_INVALID_PARAMETER;
}
for (Link = gHandleList.BackLink; Link != &gHandleList; Link = Link->BackLink) {
Handle = CR (Link, IHANDLE, AllHandles, EFI_HANDLE_SIGNATURE);
if (Handle == (IHANDLE *) UserHandle) {
return EFI_SUCCESS;
}
}
return EFI_INVALID_PARAMETER;
}
@ -643,19 +648,16 @@ CoreDisconnectControllersUsingProtocolInterface (
//
do {
ItemFound = FALSE;
for ( Link = Prot->OpenList.ForwardLink;
(Link != &Prot->OpenList) && !ItemFound;
Link = Link->ForwardLink ) {
for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList; Link = Link->ForwardLink) {
OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);
if ((OpenData->Attributes & EFI_OPEN_PROTOCOL_BY_DRIVER) != 0) {
ItemFound = TRUE;
CoreReleaseProtocolLock ();
Status = CoreDisconnectController (UserHandle, OpenData->AgentHandle, NULL);
CoreAcquireProtocolLock ();
if (EFI_ERROR (Status)) {
ItemFound = FALSE;
break;
if (!EFI_ERROR (Status)) {
ItemFound = TRUE;
}
break;
}
}
} while (ItemFound);
@ -664,21 +666,17 @@ CoreDisconnectControllersUsingProtocolInterface (
//
// Attempt to remove BY_HANDLE_PROTOOCL and GET_PROTOCOL and TEST_PROTOCOL Open List items
//
do {
ItemFound = FALSE;
for ( Link = Prot->OpenList.ForwardLink;
(Link != &Prot->OpenList) && !ItemFound;
Link = Link->ForwardLink ) {
for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList;) {
OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);
if ((OpenData->Attributes &
(EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL | EFI_OPEN_PROTOCOL_GET_PROTOCOL | EFI_OPEN_PROTOCOL_TEST_PROTOCOL)) != 0) {
ItemFound = TRUE;
RemoveEntryList (&OpenData->Link);
Link = RemoveEntryList (&OpenData->Link);
Prot->OpenListCount--;
CoreFreePool (OpenData);
} else {
Link = Link->ForwardLink;
}
}
} while (ItemFound);
}
//
@ -1132,7 +1130,7 @@ CoreOpenProtocol (
if (ByDriver) {
do {
Disconnect = FALSE;
for ( Link = Prot->OpenList.ForwardLink; (Link != &Prot->OpenList) && (!Disconnect); Link = Link->ForwardLink) {
for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList; Link = Link->ForwardLink) {
OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);
if ((OpenData->Attributes & EFI_OPEN_PROTOCOL_BY_DRIVER) != 0) {
Disconnect = TRUE;
@ -1142,6 +1140,8 @@ CoreOpenProtocol (
if (EFI_ERROR (Status)) {
Status = EFI_ACCESS_DENIED;
goto Done;
} else {
break;
}
}
}